Behavioral task
behavioral1
Sample
2188-0-0x0000000000A30000-0x0000000000ED9000-memory.exe
Resource
win7-20240508-en
General
-
Target
2188-0-0x0000000000A30000-0x0000000000ED9000-memory.dmp
-
Size
4.7MB
-
MD5
97b1e86a07c2b49021c6b949008effd5
-
SHA1
6d42b4e075035a6f9c235b74ce02a166243aee04
-
SHA256
08cea1d7c0eefa25bf7f9f824afcd67d85af5f7d1679e7a3ba716a08c27edb07
-
SHA512
8a6d1010599cac43ad32f09c957bc6b0e94a653745553656db2596e3fe7c0c91e5aa4ce4992b98324bf2043dd24d07121803f5b98fcca808e000cf4bebab933f
-
SSDEEP
24576:3VNkAyhBd6V1gbYvjOoy/b/3GJFSFERfkwKdrLJgCP97g4O:PkThi1hjOj/WnS65PKdei84
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2188-0-0x0000000000A30000-0x0000000000ED9000-memory.dmp
Files
-
2188-0-0x0000000000A30000-0x0000000000ED9000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qystihol Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
typzfmip Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE